Summary
The BitWriter in vaapi_h264_enc.rs (used by build_sps_nalu() and build_pps_nalu()) writes raw RBSP bytes without inserting emulation prevention bytes (0x03) as required by H.264 Annex B (§ 7.4.1).
After the Annex B start code (00 00 00 01), any occurrence of 00 00 00, 00 00 01, 00 00 02, or 00 00 03 in the NALU payload must be escaped by inserting 0x03 before the third byte.
Impact
The build_sps_nalu function writes num_units_in_tick = 1 as 32 raw bits, which produces three consecutive 0x00 bytes at byte boundaries. A compliant H.264 Annex B parser would misinterpret these as a start code, corrupting the SPS NALU.
This path is taken when the VA-API driver doesn't emit SPS/PPS in coded output (e.g., Intel iHD driver), as checked at the bitstream_contains_sps_pps guard.
Fix
Add a post-processing pass in BitWriter::finish() (or in the callers) that scans the RBSP payload for forbidden byte sequences and inserts 0x03 escape bytes.
Location
crates/nodes/src/video/vaapi_h264_enc.rs — BitWriter::finish() (~line 717)
Origin
Flagged by automated review on PR #279.
Summary
The
BitWriterinvaapi_h264_enc.rs(used bybuild_sps_nalu()andbuild_pps_nalu()) writes raw RBSP bytes without inserting emulation prevention bytes (0x03) as required by H.264 Annex B (§ 7.4.1).After the Annex B start code (
00 00 00 01), any occurrence of00 00 00,00 00 01,00 00 02, or00 00 03in the NALU payload must be escaped by inserting0x03before the third byte.Impact
The
build_sps_nalufunction writesnum_units_in_tick = 1as 32 raw bits, which produces three consecutive0x00bytes at byte boundaries. A compliant H.264 Annex B parser would misinterpret these as a start code, corrupting the SPS NALU.This path is taken when the VA-API driver doesn't emit SPS/PPS in coded output (e.g., Intel iHD driver), as checked at the
bitstream_contains_sps_ppsguard.Fix
Add a post-processing pass in
BitWriter::finish()(or in the callers) that scans the RBSP payload for forbidden byte sequences and inserts0x03escape bytes.Location
crates/nodes/src/video/vaapi_h264_enc.rs—BitWriter::finish()(~line 717)Origin
Flagged by automated review on PR #279.